EUVD-2026-28034Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Google Chrome versions prior to 148.0.7778.96 contain insufficient input validation in DevTools that allows remote attackers with a compromised renderer process to leak cross-origin data through crafted HTML pages. The vulnerability requires user interaction and a pre-compromised renderer, limiting real-world exploitation but presenting a significant attack chaining vector for multi-stage exploits. Patch available from vendor.
Technical ContextAI
This vulnerability exists in Chrome's DevTools implementation, which is responsible for debugging and inspection capabilities. The root cause is CWE-20 (Improper Input Validation), indicating that DevTools fails to properly sanitize or validate untrusted input when processing HTML content. The attack leverages a compromised renderer process-the sandboxed context that executes web content-as the attack origin point. By sending crafted HTML through DevTools, an attacker can bypass same-origin policy protections and access cross-origin data that should be isolated. This is a classic case of sandbox escape or context confusion where the DevTools interface does not maintain proper origin boundaries when parsing user-supplied input.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later immediately. This is the vendor-released patch that addresses the DevTools input validation defect. Users can verify their Chrome version by navigating to Chrome Menu > Help > About Google Chrome, which will automatically check for and apply updates. The patch should be deployed across all Chrome installations without workarounds; no configuration changes or feature disablement is necessary. For enterprise deployments using Chrome policies, ensure automatic updates are enabled or manually deploy version 148.0.7778.96 or later through your software distribution mechanism. See the official Chrome release notes at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for platform-specific details.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today